Sagan low stable other

[AS400] AUTFAIL - Operation SVRPGM wihtout authority

[AS400] AUTFAIL - Operation SVRPGM wihtout authority

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[AS400] AUTFAIL - Operation SVRPGM wihtout authority"; content: " MAF1100 "; default_proto: tcp; classtype: unsuccessful-user; normalize; after: track by_username, count 3, seconds 900; threshold: type suppress, track by_username, count 2, seconds 900; sid:5003776; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...